Private keys for eight eMudhra intermediate certificates have been confirmed recoverable, prompting browser vendors to block them. Hong Kong businesses should update browsers and trust stores, and check their servers’ certificate chains for impersonation risks and possible service disruption.
Eight compromised intermediates, six used for TLS
Mozilla’s official incident record identifies six TLS intermediates and two code-signing intermediates. Mozilla independently recovered the affected private keys, confirming a serious key-generation flaw. Possession of those keys could enable website impersonation against clients that still trust the affected hierarchy.
According to Mozilla’s October 20 announcement, it received the report at 20:06 UTC on October 17 and completed OneCRL distribution for Firefox users with standard settings by 22:59 UTC that day. An attacker able to intercept a connection could potentially read or modify traffic using a fraudulent certificate.
Root distrust can also disrupt existing websites
Google’s official announcement says Chrome has blocked the affected keys. Removal of emSign ECC Root CA – G3 is expected for all devices using the Chrome Root Store on the morning of October 27, Pacific time, and sooner on prerelease channels. Operators using chains to that root should immediately install replacement TLS certificates from another trusted hierarchy to prevent connection failures.
In its October 21 statement, eMudhra says a specific group of intermediates created in April 2025 is involved, while root CA private keys and other intermediates are unaffected by this flaw. Investigation continues. Compromised intermediate keys and precautionary root distrust have different scopes; operators must inspect their actual chains rather than assume every certificate from the brand has failed.
Three practical steps for Hong Kong businesses
Red Hat’s official bulletin warns that TLS applications can still trust fraudulent certificates until the trust store is updated, and urges affected deployments to install updates when available. Browser protection does not establish that servers or applications have also been updated.
- Update clients and trust stores. Apply vendor security updates; include containers, application runtimes and custom trust stores in the review.
- Inventory public service certificates. Ask hosting or certificate providers whether websites, APIs or other services chain to emSign ECC Root CA – G3. Replace affected chains and test the complete deployment.
- Verify critical journeys. Test payments, sign-in and integrations after replacement. Investigate certificate errors instead of disabling TLS verification to restore service.
Verified on October 21, 2026. Practical guidance is this website’s synthesis of official notices. Check the latest vendor announcements for trust-removal schedules and updates.